## 1. Introduction

## 2. Security against an Eavesdropper with Time-Limited Storage

_{X}(x), into the input states ρ

_{A}(x)’s. Then Bob will receive the output states ${\rho}_{B}(x)={\mathcal{N}}_{A\to B}^{\u2a02n}({\rho}_{A}(x))$. Let us recall that a quantum channel ${\mathrm{N}}_{A\to B}$ can always be represented as the reduced dynamics induced by a unitary transformation on a larger space, that is,

_{E}is a pure state for a quantum system associated with the environment of the channel, and U is a unitary transformation coupling the system with its environment. In the worst-case scenario the eavesdropper Eve might collect all the information leaking into the channel environment, in which case the state obtained by Eve reads ${\rho}_{E}(x)={\tilde{\mathcal{N}}}_{A\to E}^{\u2a02n}({\rho}_{A}(x))$, where ${\tilde{\mathcal{N}}}_{A\to E}$ is the complementary channel, defined as

_{XE}, and ∥ · ∥

_{1}= Tr| · |. If the trace distance is small, this implies that the state σ

_{XE}is close to the uncorrelated state σ

_{X}⨂ σ

_{E}. Recall that, from an operational point of view, the trace distance is the bias in distinguishing the states by a measurement. The trace norm is indeed the standard security quantifier used in quantum key distribution: if Δ ≤ ϵ, the communication protocol is secure up to a probability ϵ [7].

_{y}} are POVM elements, satisfying Λ

_{y}≥ 0 and the completeness relation $\sum {}_{y}}{\mathrm{\Lambda}}_{y}=\mathbb{I$. A post-measurement security criterion requires that the joint probability distribution ${p}_{XY}^{\mathrm{\Lambda}}(x,y)={p}_{X}(x){p}_{Y|x}^{\mathrm{\Lambda}}(y)$ is close to the product of its marginals ${p}_{X}(x){p}_{Y}^{\mathrm{\Lambda}}(y)$, where ${p}_{Y}^{\mathrm{\Lambda}}(y)={\displaystyle \sum {}_{x}}{p}_{X}(x){p}_{Y|x}^{\mathrm{\Lambda}}(y)$, for all measurements Λ. Here we consider the distance

_{acc}is the bias in distinguishing between the classical distributions ${p}_{XY}^{\mathrm{\Lambda}}$ and ${p}_{X}{p}_{Y}^{\mathrm{\Lambda}}$. In other words, Δ

_{acc}is the bias in distinguishing between the states σ

_{XE}and σ

_{X}⨂ σ

_{E}by a local measurement.

_{acc}. Let us recall that the accessible information is defined as the maximum classical mutual information that Eve can obtain about the input variable by local measurements on her subsystem, that is,

_{acc}and I

_{acc}(X; E) as security quantifiers. If the accessible information is small, Pinsker’s inequality implies that the Δ

_{acc}is also small. Viceversa, if Δ

_{acc}is small, then the accessible information is small provided Δ

_{acc}≪ (log d

^{n})

^{−1}= n

^{−1}/log d.

## 3. Quantum Data Locking

_{acc}(X; E) ≤ ϵ log d

^{n}.

_{acc}(X; E) ≤ ϵ log d

^{n}we need an asymptotic secret-key consumption rate (in bits per channel use) of (assuming that ϵ is either constant or decreases sub-exponentially in n)

_{n}

_{→∞}1/n log M is the asymptotic communication rate, and γ depends on the details of communication channel and of the codes employed.

#### 3.1. Methods

_{k}(x)⟩’s. Since she does not know the code, the state (3) reads:

_{XE}reads

_{y}= μ

_{y}|ϕ

_{y}〉 〈ϕ

_{y}| where the |ϕ

_{y}〉’s s are unit vectors and μ

_{y}>0. The condition $\sum {}_{y}}{\mu}_{y}\phantom{\rule{0.2em}{0ex}}|{\varphi}_{y}\rangle \phantom{\rule{0.2em}{0ex}}\langle {\varphi}_{y}\phantom{\rule{0.2em}{0ex}}|=\mathbb{I$ implies ∑

_{y}|μ

_{y}/d

^{n}= 1. Putting Qx(ϕy) = ⟨ϕy|ρ(x)|ϕy⟩, we then obtain

_{y})] = − ∑

_{x}Q

_{x}(ϕ

_{y}) log Q

_{x}(ϕ

_{y}). Finally, we notice that the positive quantities μ

_{y}/d

^{n}can be interpreted as probability weights. An upper bound on the accessible information is then obtained by the fact that the average cannot exceed the maximum, which yields

^{n}for n and K large enough. Consider the case of random codes, where the codewords in ${\mathcal{C}}_{k}$ are chosen i.i.d. from a certain ensemble of states. Then for any given x and |ϕ⟩ the quantity

_{x}(ϕ) ~ (1 ± ϵ)/d

^{n}, then H[Q(ϕ)] ≳ (1 − ϵ)M=d

^{n}log d

^{n}, and η[∑

_{x}Q

_{x}(ϕ)] ~ η[M/d

^{n}] = −M/d

^{n}log M/d

^{n}, which finally implies I

_{acc}(X; E) ≲ ϵ log d

^{n}.

_{x}(ϕ) is close enough to its average for all x and |ϕ⟩ can be obtained by applying suitable concentration inequalities [20,21]. For n large enough and if ϵ decreases sublinearly with n, we have obtained the following condition on K [5]:

_{k;j}(x)⟩’s are drawn i.i.d. from the uniform distribution on the unit sphere in ℂ

^{d}. For these separable codewords we obtain $\mathbb{E}[{Q}_{x}{(\varphi )}^{2}]={[\frac{2}{d(d+1)}]}^{n}$, which yields ${\gamma}^{n}={(\frac{2d}{d+1})}^{n}$ This result corresponds to the quantum data locking protocols discussed in [5]. Given a noisy channel allowing a classical communication rate χ, we obtain a secret-key consumption rate of k = max {1 − log (1 + 1/d), log d – χ} bits per channel use.

#### 3.2. Applications

_{k;j}(x)⟩ are random codewords drawn from the uniform distribution on the unit sphere in ℂ

^{d}. Given that the channel from Alice to Bob is a memoryless qudit erasure channel with erasure probability p, they can achieve a classical communication rate (in bits per channel use) of

_{0}is a given density operator [5].

^{n}~ 2

^{ng}

^{(}

^{N}

^{)}, with g(N) = (N + 1) log (N + 1) − N log N. Here we consider a weak-locking scenario where Eve measures the complementary channel, which in this case is also a lossy bosonic channel with transmissivity (1 − η). Inspired by [22] we have introduced a reverse-reconciliation protocol for secret-key generation by quantum data locking. In this protocol Alice and Bob publicly agree on a collection of measurements Λ

_{k}, for k = 1,…, K. Then Alice locally prepares a bipartite entangled state and sends one subsystems to Bob through the quantum channel. According to the value of the pre-shared secret key, Bob makes the measurement Λ

_{k}. This induces a virtual backward quantum channel from Bob to Alice. As shown in [6], this protocol may achieve an asymptotic classical communication rate of χ = g(N) − g[(1 − η)N′] bits per mode, with N′ = N/(1 + ηN). On the other hand, weak locking can be obtained with a secret-key consumption rate of k = 2g[(1 − η)N] − g[(1 − η)N′] − g[(1 − η)N″], with N″ = (1 + 2ηN)N′. In this way we achieve a net weak-locking rate of r = χ − k bits per mode which, in the limit of N → ∞ yields, for any η > 0,

## 4. Conclusions

## Acknowledgments

## Conflicts of Interest

## References

- Bennett, C.H.; Brassard, G. Quantum cryptography: Public key distribution and coin tossing. Proceedings of the IEEE International Conference on Computers, Systems and Signal Processing, Bangalore, India, 10–12 December, 1984; 175, p. 8.
- Takeoka, M.; Guha, S.; Wilde, M.M. Fundamental rate-loss tradeoff for optical quantum key distribution. Nat. Commun.
**2014**, 5. [Google Scholar] [CrossRef] - Damgard, I.B.; Fehr, S.; Renner, R.; Salvail, L.; Schaffner, C. A Tight High-Order Entropic Quantum Uncertainty Relation with Applications. In Advances in Cryptology—CRYPTO 2007; Lecture Notes in Computer Science; Springer: Berlin/Heidelberg, Germany, 2007; Volume 4622, pp. 360–378. [Google Scholar]
- Lupo, C.; Lloyd, S. Quantum-locked key distribution at nearly the classical capacity rate. Phys. Rev. Lett.
**2014**, 113, 160502. [Google Scholar] - Lupo, C.; Lloyd, S. Quantum data locking for high-rate private communication. New J. Phys.
**2015**, 17, 033022. [Google Scholar] - Lupo, C.; Lloyd, S. How to pull yourself up by your adversary’s quantum discord; 2015; arXiv:1501.07212. [Google Scholar]
- Koenig, R.; Renner, R.; Bariska, A.; Maurer, U. Small Accessible Quantum Information Does Not Imply Security. Phys. Rev. Lett.
**2007**, 98, 140502. [Google Scholar] - Alicki, R.; Fannes, M. Continuity of Quantum Conditional Information. J. Phys. A
**2004**, 98, L55. [Google Scholar] - Fedotov, A.A.; Harremoës, P.; Topsøe, F. Refinements of Pinsker’s inequality. IEEE Trans. Inf. Theory
**2003**, 49, 1491–1498. [Google Scholar] - DiVincenzo, D.P.; Horodecki, M.; Leung, D.W.; Smolin, J.A.; Terhal, B.M. Locking classical correlations in quantum states. Phys. Rev. Lett.
**2004**, 92, 067902. [Google Scholar] - Hayden, P.; Leung, D.; Shor, P.W.; Winter, A. Randomizing quantum states: Constructions and applications. Comm. Math. Phys.
**2004**, 250, 371–391. [Google Scholar] - Fawzi, O.; Hayden, P.; Sen, P. From low-distortion norm embeddings to explicit uncertainty relations and efficient information locking. J. ACM
**2013**, 60. [Google Scholar] [CrossRef] - Dupuis, F.; Florjanczyk, J.; Hayden, P.; Leung, D. The locking-decoding frontier for generic dynamics. Proc. R. Soc. A Math. Phys. Eng. Sci.
**2013**, 469, 20130289. [Google Scholar] - Lupo, C.; Wilde, M.M.; Lloyd, S. Robust quantum data locking from phase modulation. Phys. Rev. A
**2014**, 90, 022326. [Google Scholar] - Guha, S.; Hayden, P.; Krovi, H.; Lloyd, S.; Lupo, C.; Shapiro, J.H.; Takeoka, M.; Wilde, M.M. Quantum enigma machines and the locking capacity of a quantum channel. Phys. Rev. X
**2014**, 4, 011016. [Google Scholar] - Lloyd, S. Quantum enigma machines; 2013; arXiv:1307.0380. [Google Scholar]
- Devetak, I. The private classical capacity and quantum capacity of a quantum channel. IEEE Trans. Inf. Theory
**2005**, 51, 44–55. [Google Scholar] - Cai, N.; Winter, A.; Yeung, R.W. Quantum privacy and quantum wiretap channels. Probl. Inf. Transm.
**2004**, 40, 318–336. [Google Scholar] - Winter, A. Weak locking capacity of quantum channels can be much larger than private capacity; 2014; arXiv:1403.6361. [Google Scholar]
- Maurer, A. A bound on the deviation probability for sums of non-negative random variables. J. Inequal. Pure Appl. Math.
**2003**, 4. Article 15. [Google Scholar] - Ahlswede, R.; Winter, A. Strong converse for identication via quantum channels. IEEE Trans. Inf. Theory
**2002**, 48, 569–579. [Google Scholar] - Pirandola, S.; García-Patrón, R.; Braunstein, S.L.; Lloyd, S. Direct and reverse secret-key capacities of a quantum channel. Phys. Rev. Lett.
**2009**, 102, 050503. [Google Scholar]

**Figure 1.**Comparison of several communication rates (in bits per channel use) for the qudit erasure channel with erasure probability p, with d = 256. Weak-locking rate (solid line); private capacity (dashed line); classical capacity (dot-dashed line).

**Figure 2.**Secret-key rate (in bits per transmitted mode) vs channel transmissivity. Blue solid line: Achievable secret-key rate by quantum data locking (20). Red dashed line: Upper bound for the secret-key rate (assisted by two-way public communication) according to the standard security definition [2]. Yellow dash-dotted line: Achievable secret-key rate according to the standard security definition as given by the reverse coherent information [22].

© 2015 by the authors; licensee MDPI, Basel, Switzerland This article is an open access article distributed under the terms and conditions of the Creative Commons Attribution license (http://creativecommons.org/licenses/by/4.0/).